# 查找写入 [某个指针+0xDEC] 的地方
import idc
import idaapi

print("搜索 offset 0xDE0的引用...")

for func_ea in Functions():
    func_name = idc.get_func_name(func_ea)
    func_end = idc.get_func_attr(func_ea, FUNCATTR_END)
    
    ea = func_ea
    context = []
    
    while ea < func_end:
        disasm = idc.generate_disasm_line(ea, 0)
        mnem = idc.print_insn_mnem(ea)
        
        # 查找 [X?, #3564] 或 #0xDEC (3564的十六进制)
        if ("#3564]" in disasm or "#0xDEC]" in disasm) and mnem == "LDR":
            # 打印上下文
            print("\n" + "="*60)
            print("函数: %s (0x%X)" % (func_name, func_ea))
            print("位置: 0x%X" % ea)
            print("-"*60)
            
            # 前3条指令
            ctx = ea
            for i in range(3):
                ctx = idc.prev_head(ctx, func_ea)
            for i in range(7):
                print(idc.generate_disasm_line(ctx, 0))
                ctx = idc.next_head(ctx, func_end)
        
        ea = idc.next_head(ea, func_end)

print("\n搜索完成")